What happens if we accidentally destroy records containing personal data before a pending data subject deletion request was completed?

Destroying records containing personal data before a pending data subject deletion request is resolved is a serious incident, but the right response depends on intent, documentation, and the legal context. The destruction itself may not be unlawful in every case, yet the timing and circumstances can create significant exposure.

Why the Timing Matters

A pending deletion request changes the status of the affected records. Once an organization is on notice that a record is the subject of an active request, dispute, audit, or legal matter, that record is generally subject to a hold and should not be destroyed under routine schedules. Premature destruction can:

• Defeat the individual’s ability to verify their request was honored
• Undermine the audit trail proving what data existed and how it was handled
• Create the appearance of spoliation if the records were also relevant to litigation or investigation
• Conflict with retention requirements if the data was still subject to a legal hold for another purpose

In short, the problem is rarely the deletion alone. It is destruction outside a documented, defensible process while the records were in a protected state.

Immediate Steps

1. Stop and preserve. Halt any further destruction and place an immediate hold on related systems and backups.
2. Scope the loss. Determine exactly which records, fields, and individuals were affected, and whether copies exist in backups or downstream systems.
3. Document everything. Capture how, when, and why the destruction occurred. Contemporaneous notes are critical to demonstrating good faith.
4. Notify the right people. Engage privacy, legal, and records governance promptly. Some incidents trigger breach-notification or regulatory reporting obligations.
5. Assess the request. Ironically, deletion may partially fulfill the data subject’s original goal, but you must still confirm and document completion accurately.

Preventing Recurrence

The root cause is usually a disposition process that runs without checking for active holds. Strengthen controls so that deletion requests, legal holds, and litigation flags automatically suspend routine destruction. Reconcile retention schedules with privacy obligations, and require sign-off before any disposition of records flagged with a pending request.

Treat the event as both a privacy and a records-governance failure, not merely a technical mistake. For broader guidance, see Privacy and PII.